WS-2019-0612

In Axelor Open-Suite, versions v5.0.0-rc1 through v5.1.11 are vulnerable to XML External Entity Reference XXE, due to XXE processing not disabled when parsing a BPM workflow file. A privileged attacker can upload a specially crafted XML file and trigger DoS and in some cases even RCE...